OracleCVE-2026-70781
Oracle Proposals: takeover via Internal Operations
High7.2CVE-2026-70781 · Published Aug 18, 2026 · updated Aug 28, 2026
Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Proposals. Successful attacks of this vulnerability can result in takeover of Oracle Proposals. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Oracle Proposals Product | >= 12.2.3, <= 12.2.15 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-284
More Oracle advisories
All Oracle| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 18 | Helidon: data tampering via Imperative Web Server | High8.6 | No fix yet |
| Aug 18 | Helidon: data tampering via Imperative Web Server | Critical9.9 | No fix yet |
| Aug 18 | Helidon: data tampering via Imperative Web Server | High8.3 | No fix yet |
| Aug 18 | Helidon: flaw in Imperative Web Server | Medium5.3 | No fix yet |
| Aug 18 | Helidon: data tampering via Imperative Web Server | High7.3 | No fix yet |
| Aug 18 | Helidon: denial of service via Imperative Web Server | High7.5 | No fix yet |